David Wong

cryptologie.net

cryptography, security, and random thoughts

Hey! I'm David, cofounder of zkSecurity, advisor at Archetype, and author of the Real-World Cryptography book. I was previously a cryptography architect of Mina at O(1) Labs, the security lead for Libra/Diem at Facebook, and a security engineer at the Cryptography Services of NCC Group. Welcome to my blog about cryptography, security, and other related topics.

Apparently things are going pretty bad for one of Silk Road’s replacement : Sheep Market place is scamming its users.

Also, the creator might have been found. I’m not a big fan of posting personal info so I’ll just post this message

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2 November 2013, I was contacted on IRC by a pseudonymous chatter, "an anonymous security hobbyist". He said he had some information for me if I would swear to keep it secret. I agreed as long as it didn't involve violence like hitmen. He had been impressed by [my bet against Sheep & BMR](http://www.reddit.com/r/SilkRoad/comments/1pko9y/the_bet_bmr_and_sheep_to_die_in_a_year/) and agreed with me that the official Sheep story about `sheepmarketplace.com` was too stupid for words, and wanted to share the info with me. He then told me he had just finished researching Sheep Marketplace and was highly confident that the operator was a Czech programmer by the name of "Tomáš Ji?ikovský", and further, earlier that day he had mailed off his results to the FBI. (He also claimed credit for the BMR & PBF leaks.) After reading through his results, checking some of the links to see if they were as described, agreeing with him that Tomas matches the profile for the Sheep operator uncannily well, and reflecting how stupid I was to not look harder at sheepmarketplace.com because as soon as you see the forum posts where Tomas complains about the problems of running a Bitcoin-using hidden service it's completely obvious that Tomas=Sheep, I suggested he contact Tomas. He declined, saying he didn't want to spook Tomas (he is not a big fan of drugs), although he agreed I could release the results within 7 months. The most I managed to get out of him was permission to [post a cryptographic hash precommitment](http://www.reddit.com/r/SilkRoad/comments/1ptd6b/precommitment_proof_of_knowledge_about_a/): $ echo 'Sheep Marketplace was founded and run by Tomáš Ji?ikovský (random nonce: 19093)' | sha512sum 43a4c3b7d0a0654e1919ad6e7cbfa6f8d41bcce8f1320fbe511b6d7c38609ce5a2d39328e02e9777b339152987ea02b3f8adb57d84377fa7ccb708658b7d2edc - I was as precise as I could be at the time; saying it was a precommitment to Tomas's identity would have clearly breached the agreement. Anyway, I took his notes, made copies of all the webpages linked in, and prepared a single compilation in MAFF format: https://dl.dropboxusercontent.com/u/182368464/2013-11-03-sheepmarketplace-doxxing.maff The basic overview of the findings: 1. Tomas owns the hosting service for the sheepmarketplace.com VPS server. There were very few domains hosted there as well, and he controlled several of them. 2. The site itself seemed to be very closely connected to SMP, using the same basic technologies and possibly a non-public API 3. The official excuse does not wash as sheepmarketplace.com was set up not long after SMP itself 4. Tomas is the earliest known promoter of SMP (1 February 2013), and recommened SMP & BMR over Silk Road (11 April 2013) 5. Tomas is a C++ QT Nette Framework Czech developer who runs Ubuntu, exactly like the SMP developer 6. Tomas has complained about the memory demand of `bitcoind` on a VPS server, and discussed the difficulties of functionality like email from hidden services 7. Tomas or his girlfriend are active users of Tor, as evidenced by screenshots of their computer 8. it's not clear what Tomas's current job is 9. but it is clear that as of October, he was working on an e-commerce site which was having problems with buggy accounting of deposits 10. Tomas posted a .htaccess file which has the same (buggy) functionality as that of SMP 11. He is an accused Bitcoin scammer A few of these could be explained as coincidence. But all of them? At this point, I would rate Tomas as >75% likely to be involved with SMP in some fashion. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iEYEAREKAAYFAlKaXN8ACgkQvpDo5Pfl1oJ+HwCgnQmvBZFTHkzDEHzayEmrTnjB d+oAnjK0a0UFDwg+wAvkDxsjer6w8rXl =tYBY -----END PGP SIGNATURE-----/

poster is gwern, more info on reddit.

Canal discret sans mémoire

blog

In my quest to better support to learn, I’ve again stumbled into a complicated, badly explained and unclear paper from my prof about discreet and time-memoryless channels.

Although it might be just me, but when I don’t understand something from one source I like to diversify, and papers from Polytechnique (in french) are always a good snack :

http://www.enseignement.polytechnique.fr/profs/informatique/Nicolas.Sendrier/TI/cours6.pdf

suggested reads:

Claude Shannon

blog

Learning about Shannon’s theorem in class I got curious and googled the guy.

One extract I found interesting in his wikipedia biography :

Shannon and his wife Betty also used to go on weekends to Las Vegas with M.I.T. mathematician Ed Thorp, and made very successful forays in blackjack using game theory type methods co-developed with fellow Bell Labs associate, physicist John L. Kelly Jr. based on principles of information theory. They made a fortune, as detailed in the book Fortune’s Formula by William Poundstone and corroborated by the writings of Elwyn Berlekamp, Kelly’s research assistant in 1960 and 1962. Shannon and Thorp also applied the same theory, later known as the Kelly criterion, to the stock market with even better results. Claude Shannon’s card count techniques were explained in Bringing Down the House, the best-selling book published in 2003 about the MIT Blackjack Team by Ben Mezrich. In 2008, the book was adapted into a drama film titled 21.

Apart for inventing most of cryptography concepts, and doing chess IA, he also made a fortune from gambling and playing with stocks. Interesting.

suggested reads:

bordeaux1 url

blog

My portfolio/vitrine/online resume… call it what you want, which is available on davidwong.fr, is now available on david.wong.emi.u-bordeaux1.fr as well. I thought that was pretty cool to have a bordeaux1.fr url. I think I can also have a univ-lyon1.fr since my account is still active but I can’t be bothered looking at where it is.

Anyway, just this small piece of news in the ocean of bitcoin/litecoin news I’ve been posting here. Exams are coming soon and I should blog more about them than cryptocoins but yeah…

suggested reads:

I’ve had problems with bitcoins, but that’s okay, because I did invest 100$ back when litecoins were 5$/LTC. Right now, they’re growing crazily fast, and faster than bitcoins.

Yahoo has a great article dedicated to that amazing fact:

Here’s What You Need To Know About The Digital Currency Growing Faster Than Bitcoin

And here’s a reddit thread on /r/litecoin called : For begginers : How to buy LTC.

suggested reads:

Bitcoin reached 877$/bitcoin today. I had 11 bitcoins that I bought for 450$ in total (40$/bitcoin) and which I lost trading and losing my wallet as well. I’m raging every time I think of the free holidays I could have paid myself with them.

But not all is lost, I have some litecoins and they just reached a peak of 14$ / litecoin. They’re following bitcoins’ rate closely and they’re just waiting to become “mainstream” as well to boom.

Fingers crossed.

8 pages of simple explanations

and a “explain me like I’m 5” post on reddit :

Bitcoin is a giant public ledger saying who sent what coins to whom. People have private keys, which they use to sign coin transfers. It's easy to verify signatures. That way only you can give away your coins. But that doesn't prevent you from giving the same coins to multiple people. For that we have the ledger, which puts all the transfers in a particular order that everyone agrees on so you can't pay someone with coins you already spent. Transactions are published on a p2p network. To put them in order, people take sets of transactions, add a random number, and make a cryptographic hash of the whole thing. (Feed data into a hash function and you get an unpredictable number.) If the hash is a low enough number it's a valid block and it becomes part of the blockchain. If it's too high, you change the random number and try again. The block also includes the hash of the previous block, so that puts everything in sequence. It takes a lot of tries to get a low-enough number, so only one block is published every ten minutes or so, by some random person who got lucky. This puts everything in order. It's expensive to do that, so when someone successfully generates a block, they get paid by a special bitcoin transaction that awards them some brand-new coins. That's mining.
"We've heard a good bit in this courtroom about public key encryption," said Albright. "Are you familiar with that?" "Yes, I am," said Diffie, in what surely qualified as the biggest understatement of the trial. "And how is it that you're familiar with public key encryption?" "I invented it."

A nice piece of journalism about how Diffie stood out in court to “knock out the Jones patent with “clear and convincing” evidence (which is the standard for invalidating a patent).”.

Learning more about the guy who is behind the Diffie-Hellman handshake.

more info here

📖 my book
Real-World Cryptography is available from Manning Publications.
A practical guide to applied cryptography for developers and security professionals.
🎙️ my podcast
Two And A Half Coins on Spotify.
Discussing cryptocurrencies, databases, banking, and distributed systems.
📺 my youtube
Cryptography videos on YouTube.
Video explanations of cryptographic concepts and security topics.
page info:
page 60 of 63
622 posts total